covers common issues in cybersecurity laws and regulations, including cybercrime, applicable laws, preventing attacks, specific sectors, corporate governance, litigation, insurance, and investigatory and police powers. Other relevant laws applicable to cybercrimes include the Electronic Communications Protection Act (“ECPA”), which provides protections for communications in storage and in transit.  Under the Stored Communications Act (Title II of the ECPA), 18 U.S.C. § 2702, it is a criminal violation to intentionally access without authorisation (or exceed authorised access) a facility that provides an electronic communications service (“ECS”), which could include, among others, email service providers or even some employer-provided email.  Violations of the ECPA are subject to penalties ranging from a fine or up to one year of imprisonment (or both), to up to 10 years for repeat violations for an improper purpose.  The ECPA also prohibits intentionally intercepting electronic communications in transit under the Wiretap Act (Title I of the ECPA), 18 U.S.C. § 2511, with some exceptions available for law enforcement, service providers and others (including, potentially, employers).  The Economic Espionage Act of 1996, 18 U.S.C. §§ 1831–1839, the Defend Trade Secrets Act of 2016, 18 U.S.C. §§ 1836–1839, and the Wire Fraud statute, 18 U.S.C. § 1343, are further sources of potential criminal and civil penalties against the theft of trade secrets and other valuable intellectual property. Yes, a DOS attack could violate the CFAA, 18 U.S.C. § 1030(a)(5)(A) (intentionally damaging through knowing transmission, imprisonment up to 10 years), as well as state computer crime laws. Yes, among other statutes, phishing could violate the CFAA, 18 U.S.C. § 1030(a)(5)(A) or constitute wire fraud under 18 U.S.C. § 1343, which carries a potential sentence of up to 20 years’ imprisonment. Yes, planting malware would violate the CFAA, 18 U.S.C. § 1030(a)(5)(A) (intentionally damaging through knowing transmission, imprisonment up to 10 years), as well as state computer crime laws. 18 U.S.C. § 2512 criminalises the manufacture, distribution, possession, and advertising of wiretapping devices, which would include many such tools. Conspiracy to commit an offence is often separately subject to criminal sanction.  Whether distribution of hacking tools would constitute a crime would depend on whether the actor intended for them to be used for illegal purposes.  If there were evidence of criminal intent, a person may be liable for aiding and abetting the violation of the CFAA, 18 U.S.C. § 1030(a)(5)(A), or related computer crime laws.  With respect to federal statutes, aiding and abetting is subject to the same sentence as commission of the offence. As with distribution, mere possession of hacking tools would be difficult to prosecute in the absence of intent to use them for illegal purposes or related conspiracy.  If there were evidence of criminal intent or conspiracy and some overt act taken towards that end, a person may be liable for an attempt to violate the CFAA, 18 U.S.C. § 1030(a)(5)(A), or related computer crimes laws.  With respect to federal statutes, attempt is subject to the same sentence as commission of the offence. Yes, identity theft could be charged under the federal identity theft statute, 18 U.S.C. § 1028, as well as numerous state laws. Yes.  Unsolicited penetration testing could constitute a violation of the CFAA and state laws if the tester obtains data as a result or causes damage.  To the extent information was obtained from the systems tested, such testing could violate 18 U.S.C. § 1030(a)(1) (national security information, imprisonment up to 10 years), (2) (obtaining information, imprisonment up to one year, or five if aggravating factors apply), or (3) (government computers, imprisonment up to one year).  If the penetration tester causes damage, e.g. by impairing the integrity or availability of a system or data, the action could constitute a violation of § 18 U.S.C. § 1030(a)(5). The CFAA, 18 U.S.C. § 1030(a)(2), and wire fraud statute, 18 U.S.C. § 2702, as well as numerous state laws apply to a wide variety of criminal conduct online. Yes, the USA PATRIOT Act amended the CFAA and Access Device Fraud statute, 18 U.S.C. § 1029, to expressly apply them extraterritorially. The U.S. Department of Justice has released a policy statement to the effect that it will no longer prosecute ethical hackers.  The nature of the crime, whether it was intentional or unintentional, whether it was committed for economic benefit or malice or ethical hacking, and the number of past offences may impact the severity of any penalty.  The existence of a robust corporate compliance programme, as well as cooperation with law enforcement, may help to mitigate any penalty or influence prosecutorial discretion. Numerous federal and state laws include cybersecurity requirements.  The Federal Trade Commission (“FTC”) has been particularly active in this space and has interpreted its enforcement authority under § 5(a) of the FTC Act, applying to unfair and deceptive practices, as a means to require companies to implement security measures.  The FTC has brought numerous enforcement actions against companies it alleges failed to implement reasonable security measures.  The U.S. Supreme Court decision in AMG Capital Management v. FTC limited the FTC’s abilities to seek monetary penalties for potential violations of the FTC Act without first utilising its administrative procedures, although the FTC has continued to seek such penalties in settlements by reference to administrative and other authorities. Some federal laws, however, are sector-specific or extend only to public companies.  Securities law generally prohibits fraud in connection with securities, and the Securities and Exchange Commission (“SEC”) has been rigorous in the enforcement of disclosure requirements for adequate public disclosures regarding cybersecurity risks and material cybersecurity incidents for both public companies and regulated financial institutions.  Moreover, the Gramm-Leach-Bliley Act (“GLBA”) and its implementing regulations require “financial institutions” to implement written policies and procedures that are “reasonably designed” to ensure the security and confidentiality of customer records and protect against anticipated threats and unauthorised access and use.  Recently, regulators including the FTC and SEC have adopted or proposed new regulations requiring that covered organisations adopt more specific cybersecurity measures.  The Health Insurance Portability and Accountability Act (“HIPAA”) includes cybersecurity requirements applicable to protected health information in the possession of certain “covered entities” and their “business associates”.  Computer crime laws may be used to protect against unlawful hacking, including with respect to the theft of trade secrets. All 50 U.S. states plus Washington, D.C. and three federal territories have in place data breach notification laws, and the SEC has recently adopted a final rule requiring that, from December 18, 2023, public companies report material cybersecurity incidents in a Form 8-K within four business days from the date on which the incident was determined to be material.  Smaller reporting entities have until June 2024 to comply. The Cybersecurity and Infrastructure Security Agency Act created the Cybersecurity and Infrastructure Security Agency (“CISA”), a component of the Department of Homeland Security, and the federal agency responsible for protecting critical infrastructure in the United States.  CISA coordinates between government and private sector organisations in protecting critical infrastructure and develops and transmits information to private sector entities regarding its expertise in cybersecurity vulnerabilities, incident response and cybersecurity risk.  In March 2022, Congress passed, and President Biden signed into law, the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”), which will require reporting by covered entities within the critical infrastructure sector of “significant cyber incidents” and ransomware payments to CISA.  Key details require further development through rulemaking, including the scope of covered entities required to report and the types of incidents requiring reporting, among other things.  A draft Notice of Proposed Rulemaking will be published before the end of March 2024.  The federal government has also issued sector-specific guidance for critical infrastructure operators, and the nuclear, chemical, electrical, government contracting, transportation and other sectors have detailed statutory and regulatory requirements. 2.3        Security measures: Are organisations required under Applicable Laws to take measures to monitor, detect, prevent or mitigate Incidents? If so, please describe what measures are required to be taken. 2.4        Reporting to authorities: Are organisations required under Applicable Laws, or otherwise expected by a regulatory or other authority, to report information related to Incidents or potential Incidents (including cyber threat information, such as malware signatures, network vulnerabilities and other technical characteristics identifying a cyber-attack or attack methodology) to a regulatory or other authority in your jurisdiction? If so, please provide details of: (a) the circumstance in which this reporting obligation is triggered; (b) the regulatory or other authority to which the information is required to be reported; (c) the nature and scope of information that is required to be reported; and (d) whether any defences or exemptions exist by which the organisation might prevent publication of that information. Yes, all 50 U.S. states, Washington, D.C. and three federal territories have requirements for the reporting of Incidents, and most of these statutes require reporting to state regulators.  The nature and scope of the information that is required to be reported varies by state or territory.  For example, California requires the following information in notices sent to individuals: (1) the name and contact of the reporting person; (2) a list of the types of personal information breached; (3) the date of the breach (or estimated range); (4) whether notification was delayed by a law enforcement investigation; (5) a general description of the breach incident (if possible); and (6) toll-free numbers and addresses of the major credit card reporting agencies. Under rules adopted by the SEC in July 2023, public companies that are not smaller reporting companies must report material cybersecurity incidents in a Form 8-K within four business days of making a materiality determination, beginning on December 18, 2023.  Smaller reporting companies must comply with the rule in June 2024.  Public companies are required to make their materiality determination “without unreasonable delay” following discovery of the incident.  The notification should include information about the nature, scope, timing, and material impact of the incident.  Additionally, public companies are required to make annual disclosures of material information regarding cybersecurity risk management, strategy, and governance. These state requirements are in addition to federal requirements that are sector-specific.  For example, the Department of Health and Human Services (“HHS”) Office of Civil Rights (“OCR”) requires covered entities and business associates to report certain Incidents involving Protected Health Information (“PHI”).  In February 2022, the SEC issued draft regulations that would require reporting of “significant adviser” or “significant fund cybersecurity incidents” within 48 hours of reasonably concluding that an Incident has occurred.  The SEC is currently reviewing comments regarding its proposed rules.  Lastly, Congress passed CIRCIA in March 2022, which will create another reporting regime applicable to certain organisations within critical infrastructure sectors. Information about cyber threats generally need not be reported, although the federal government encourages participation in Information Sharing and Analysis Centers (“ISACs”) or Information Sharing and Analysis Organizations (“ISAOs”) where threat intelligence is shared within sector-specific groups of companies.  CISA also strongly encourages sharing breach information with it, along with other cyber threat indicators. 2.5        Reporting to affected individuals or third parties: Are organisations required under Applicable Laws, or otherwise expected by a regulatory or other authority, to report information related to Incidents or potential Incidents to any affected individuals? If so, please provide details of: (a) the circumstance in which this reporting obligation is triggered; and (b) the nature and scope of information that is required to be reported. Timeframes for notification vary by state; however, 30 days is a common standard.  Additionally, some sector-specific laws provide notification requirements.  The HIPAA Breach Notification Rule, 45 CFR §§ 164.400–414, requires HIPAA-covered entities and business associates to provide notifications in the event of certain Incidents impacting PHI. 2.6        Responsible authority(ies): Please provide details of the regulator(s) or authority(ies) responsible for the above-mentioned requirements. The regulator varies by sector, law and state.  The FTC is the principal U.S. federal privacy regulator covering most for-profit businesses not overseen by other regulators.  The SEC regulates many financial institutions, and the OCR is primarily responsible for enforcing HIPAA.  CISA plays an increasingly significant role in protecting U.S. critical infrastructure, and its role in notification has and will continue to be expanded through the regulatory process implementing CIRCIA.  State Attorneys General have broad authority regarding enforcement of cybersecurity matters.  California has a first-in-the-nation regulator, the California Privacy Protection Agency, dedicated to privacy regulation and enforcement.  In addition, federal and state regulators in particular sectors, such as insurance, have further enforcement powers. The United States has no single framework for non-compliance with notice requirements, and penalties will depend heavily on the relevant law and regulator, many of which pursue violations as unfair or deceptive trade practices.  In addition to regulatory penalties, private plaintiffs may file actions alleging non-compliance with relevant laws.  For example, the CCPA provides for statutory damages of between $100 to $750 per consumer and per Incident in the event of a data breach caused by the failure to have in place reasonable security measures. 2.8        Enforcement: Please cite any specific examples of enforcement action taken in cases of non-compliance with the above-mentioned requirements. Hundreds of actions have been brought for non-compliance.  For instance, Equifax agreed to pay at least $575 million as part of a settlement with the FTC, Consumer Financial Protection Bureau (“CFPB”) and 50 U.S. state Attorneys General, or other state regulators charged with overseeing data security, related to its 2017 data breach allegedly impacting approximately 147 million people.  Government authorities alleged that Equifax failed to have in place reasonable security for the information it collected and stored.  Even individual state regulators can extract significant settlements.  In 2022, Zoetop Business Company settled with the New York Attorney General for $1.9 million in a data breach allegedly involving 800,000 New York residents; although, millions of account records were potentially compromised worldwide. Typical of the FTC’s enforcement is a case involving Uber in which it entered into an expanded settlement with Uber arising from a 2016 data breach, which the FTC alleged was not disclosed to the FTC for more than a year.  The FTC had previously settled allegations related to an earlier 2014 breach.  The FTC had alleged that Uber failed to live up to statements that access to rider and driver accounts were closely monitored, which, the FTC alleged, was not the case, rendering the statements false or misleading. Although the CISA Law may pre-empt them, state torts such as invasion of privacy may also limit an employer’s ability to monitor employee communications, but tort law claims can be overcome where an employer can show that the employee did not have a reasonable expectation of privacy in the communication.  Connecticut, Delaware, and New York have statutes that require notice to employees of such monitoring, and such notices and consents to monitoring should be carefully drafted to ensure compliance. Yes.  Export Administration Regulations restrict the export of certain strong dual-use encryption technologies; however, licence exceptions may be available for exports. 4.1        Do legal requirements and/or market practice with respect to information security vary across different business sectors in your jurisdiction? Please include details of any common deviations from the strict legal requirements under Applicable Laws. Cybersecurity laws in the United States vary significantly by business sector.  There is currently no single U.S. cybersecurity law of general application other than, arguably, restrictions of “unfair” trade practices.  Most businesses must comply with sector-specific federal and state laws.  Healthcare organisations, for example, may need to comply with HIPAA, and many financial institutions are required to comply with the GLBA.  Related state laws impose additional requirements. In addition to the sectors of critical infrastructure in the United States such as energy, chemical, and transportation, each of which have detailed rules specific to their area, the United States has numerous sector-specific rules applicable to cybersecurity.  For example, in the financial services sector, financial services organisations must comply with the GLBA and its implementing regulations (which vary depending on the organisation’s functional regulator).  The FTC issued an updated Safeguards Rule applicable to certain financial institutions that went into operation in June 2023, and the SEC has issued its own rules applicable not only to the protection of personal information but also against other cybersecurity risks.  The SEC, other regulators and industry groups, such as the Financial Industry Regulatory Authority (“FINRA”) and the National Futures Association (“NFA”), have published cybersecurity guidance that should be carefully reviewed.  Red Flag Rules published by regulators require covered firms to adopt written programmes to detect, prevent and mitigate identity theft.  The Fair Credit Reporting Act (“FCRA”) and Fair and Accurate Credit Transactions Act (“FACTA”) impose requirements with respect to credit reports.  The FTC’s Disposal Rule, 16 C.F.R. § 682, issued pursuant to FACTA, requires certain practices for the destruction of certain information contained in or derived from a credit report.  State regulators sometimes impose very significant further regulations, particularly in New York.  A different example would be the Communications Act, as enforced by Federal Communications Commission (“FCC”) regulations, which requires telecommunications carriers and providers of Voice over Internet Protocol (“VoIP”) services to protect “customer proprietary network information”.  Substantial fines and penalties can be assessed for failure to ensure adequate protections.  Covered entities and business associates under HIPAA are subject to a variety of rules and guidance regarding the protection of certain health data. Public company boards of directors and officers owe shareholders fiduciary duties, including the duties of care and loyalty.  To fulfil these duties, among other things, boards and officers must ensure that they exercise appropriate governance over cybersecurity risk by being properly informed regarding the company’s cybersecurity risks and the efforts the company has made to address them.  Boards must also ensure that investors receive materially accurate disclosures of investment risk. In the event of an Incident, boards and officers may face scrutiny and, potentially, litigation relating to their oversight of the company’s cybersecurity.  For example, in the Yahoo! data breach, individual board members and officers faced a shareholder derivative action alleging that they failed to exercise their fiduciary duties, failed to ensure that proper security measures were in place, failed to adequately investigate the Incident and made misleading statements.  The allegations were ultimately settled for a reported $29 million.  In that same Incident, the SEC issued a $35 million fine.  The SEC adopted updated rules regarding breach reporting by public companies in July 2023. Public companies are required to publicly report material cybersecurity risks, including material past Incidents.  Even if a past Incident is not material, companies should consider them in evaluating their disclosures regarding cybersecurity.  The SEC has increased its enforcement activity regarding public company disclosures in recent years.  For example, the SEC alleged that Pearson plc, a London-based education company, made misleading disclosures regarding cybersecurity risks as hypothetical when it had recently been made aware of a breach.  The SEC has issued rules and guidance regarding the factors public companies should report with respect to cybersecurity.  Private companies do not have the same public disclosure obligations but may need to inform potential investors or purchasers regarding past Incidents or cybersecurity risks. 6.1        Please provide details of any civil or other private actions that may be brought in relation to any Incident and the elements of that action that would need to be met. Plaintiffs may also allege securities fraud.  To do so, plaintiffs must allege that the company made materially false or misleading statements, typically regarding the state of its cybersecurity posture, and that the company knew about the falsity of such statements. 6.2        Please cite any specific examples of published civil or other private actions that have been brought in your jurisdiction in relation to Incidents. Marriott: suffered a data breach incident, resulting in a purported class action, which was certified as a class by the district, only to have the certification overturned on appeal. In some states, defendants may assert the economic loss doctrine, which generally provides that contracting parties seeking damages for purely economic losses must seek damages in contract rather than in tort. There are no regulatory limitations specific to cyber insurance, but some states do not allow for insurance against certain violations of law. Yes, but any ransom payment must be screened against applicable sanctions restrictions.  U.S. companies are prohibited from making payments to persons listed on the Office of Foreign Asset Control’s (“OFAC’s”) Specifically Designated Nationals and Blocked Persons List, and payment to a sanctioned person may violate such requirements even if the payor is unaware of the sanctions nexus.  However, OFAC will consider mitigating factors in determining whether to impose any penalty and, in practice, penalties on entities that have conducted sanctions screens in good faith are rare. 8.1        Please provide details of any investigatory powers of law enforcement or other authorities under Applicable Laws in your jurisdiction (e.g. anti-terrorism laws) that may be relied upon to investigate an Incident. No general U.S. laws expressly require organisations to implement backdoors in their IT systems or provide law enforcement authorities with encryption keys.  Under the All Writs Act, some courts in some instances have ordered reasonable assistance, including in one notable case, requiring Apple to provide assistance in circumventing security features – which Apple successfully resisted until it was moot. Having worked in the past both for Allen&Overy and Freshfields in Italy I can really appreciate the quality of the country analysis in your multi-jurisdiction guides.Avv. Pasquale Stricagnolo - CNH Industrial Financial Services S.A.